Goal Reached Thanks to every supporter — we hit 100%!

Goal: 1000 CNY · Raised: 1359 CNY

100%
Buy Us a Coffee

CVE-2026-55369— Waline login accepts a non-string email as a match-all MongoDB query

Quick assessment

Affected
walinejs waline
Exploitation
No confirmed in-the-wild exploitation; assess based on exposure
Recommended action
Check the vendor advisory and references for a fixed version. If immediate upgrade is impossible, restrict exposure and increase monitoring.

Waline 是一个支持后端功能的评论系统。在 1.41.1 版本之前，其登录接口（POST /api/token）会从请求体中读取 email 字段，但未校验其数据类型，便直接将其传入 MongoDB 存储查询。当 email 字段不是字符串（例如为 JSON 对象 {"$ne": null}）时，MongoDB 存储适配器的 parseWhere 方法会静默丢弃该字段，而非拒绝请求，从而生成一个空过滤条件，匹配所有用户。随后，该接口会将提交的密码与返回的第一个用户（即 user[0]）进行验证；在 Waline

CVSS 6.5 · Medium
Get alerts for future matching vulnerabilities Log in to subscribe

I. Basic Information for CVE-2026-55369

Vulnerability Information
Have questions about the vulnerability? See if Shenlong's analysis helps!
View Shenlong Deep Dive ↗

Although we use advanced large model technology, its output may still contain inaccurate or outdated information.Shenlong tries to ensure data accuracy, but please verify and judge based on the actual situation.

Vulnerability Title
Waline login accepts a non-string email as a match-all MongoDB query
Source: CVE Program / CVE List V5
Vulnerability Description
Waline is a comment system with backend support. Prior to version 1.41.1, the login endpoint POST /api/token reads the email field from the request body without checking its type and passes it straight into the MongoDB storage query. When email is not a string (for example a JSON object such as {"$ne": null}), the MongoDB storage adapter's parseWhere silently DROPS the field rather than rejecting the request, producing an empty filter that matches ALL users. The endpoint then verifies the submitted password against the FIRST user returned (user[0]), which in Waline is the first-registered user — the site administrator. This is a PARTIAL authentication bypass, not a full one. The attacker still needs a valid password for that first user; this is not a zero-knowledge bypass and it does not disclose passwords. Its concrete effects are: (1) the email/identifier factor is removed for the administrator account, (2) user enumeration (a non-string email never fails the "no such user" branch), and (3) credential-stuffing amplification — an attacker can test a leaked or weak password against the administrator account without knowing the administrator's email. This issue has been patched in version 1.41.1.
Source: CVE Program / CVE List V5
CVSS Information
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N
Source: CVE Program / CVE List V5
Vulnerability Type
认证机制不恰当
Source: CVE Program / CVE List V5

Affected Products

Vendor Product Affected Versions CPE Subscribe
walinejs waline <= 1.40.3 -

II. Public POCs for CVE-2026-55369

# POC Description Source Link Shenlong Link
AI-Generated POC Premium

No public POC found.

Login to generate AI POC

III. Intelligence Information for CVE-2026-55369

请登录查看更多情报信息。

Other References for CVE-2026-55369 (3)

IV. Related Vulnerabilities

Same weakness: CWE-287